Threshold ML-DSA reference code had a state-reuse flaw that could leak secret shares
jedisct1 · x · 2026-09-09
Project Eleven's Conor Deegan reviewed the Go reference implementation of the first fully ML-DSA-compatible threshold signature scheme and found the code failed to enforce a security-model requirement: signing state must be used at most once. The API allowed the same round-one randomness to produce responses under two challenges, yielding an equation in the signer's secret share — analogous to nonce reuse in Schnorr.
- A fix was merged September 5 after discussion with PQShield's Guilhem Niot: state advances one round at a time, is consumed on use, and randomness is zeroized
- The repo is an academic PoC, but as the reference implementation it has already been reimplemented in other languages, making it the de facto spec for builders
More from Research
- Timothy Duff's ECCV 2026 SfM-DL workshop slides on algebraic optimality for minimal solvers — ducha_aiki · 2026-09-09
- Drop a fixed batch proportion instead of per-sample tokens: capi author shares training trick — giffmana · 2026-09-09
- Nature Methods comment: TCR antigen specificity data limited by quality, not quantity — victorgreiff · 2026-09-09
- Adding Greek to a Cosmos3 VLA policy: bilingual training helps but lags far behind English — KIEFERSA · 2026-09-09
- Transformers encode a partner's expertise early but only act on it in later layers — Mika Okamoto · 2026-09-09
- Cadence uses a time-series foundation model for error-bounded lossy compression of demand data — Roberto Tacconelli · 2026-09-09